Cherry-pick 260286.10@webkit-2023.2-embargoed (010528c). https://bugs…

….webkit.org/show_bug.cgi?id=245389 Add crash test for bad update of fixed position scrolling node https://bugs.webkit.org/show_bug.cgi?id=245389 Reviewed by Simon Fraser. This was already fixed with #255114, but add the test for completeness. * LayoutTests/fast/scrolling/fixed-positioned-element-update-crash-expected.txt: Added. * LayoutTests/fast/scrolling/fixed-positioned-element-update-crash.html: Added. Canonical link: https://commits.webkit.org/260286.10@webkit-2023.2-embargoed Canonical link: https://commits.webkit.org/263022.2@webkit-2023.4-embargoed
WebKit · Apr 17, 2023 · 3dd204c · 3dd204c
1 parent 3601da9
commit 3dd204c
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 0 deletions.
diff --git a/LayoutTests/fast/scrolling/fixed-positioned-element-update-crash-expected.txt b/LayoutTests/fast/scrolling/fixed-positioned-element-update-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crashes.
diff --git a/LayoutTests/fast/scrolling/fixed-positioned-element-update-crash.html b/LayoutTests/fast/scrolling/fixed-positioned-element-update-crash.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+ <style>
+ #container {
+   display: inline-block;
+   height: 100px;
+ }
+ #sticky {
+   position: sticky;
+   writing-mode: tb;
+   overflow-x: overlay;
+ }
+ #fixed {
+   position: fixed;
+   display: inline-block;
+ }
+ </style>
+ <div id="container">
+   <span>
+     <div id="sticky"></div>
+   </span>
+ </div>
+ <div id="fixed"></div>
+ <custom style="transform: scale(2)" id="custom"></foo>
+ <script>
+   if (window.testRunner) {
+     testRunner.waitUntilDone();
+     testRunner.dumpAsText();
+   }
+   onload = () => {
+     requestAnimationFrame(() => {
+       custom.style.setProperty("-webkit-mask-box-image", "url(about:blank)");
+       requestAnimationFrame(() => {
+         custom.style.width = "5px";
+         requestAnimationFrame(() => {
+           document.body.innerHTML = "PASS if no crashes.";
+           if (window.testRunner)
+             testRunner.notifyDone();
+         });
+       });
+     });
+   };
+ </script>